Sign in to follow this  
Followers 0
SRC510

C:\Windows\system32\svchost.exe

8 posts in this topic

Not sure if it is a virus I did a couple scans with Kaspersky and Malwarebytes but found nothing. I get numerous alerts stating C:\WINDOWS\SYSTEM32\SVCHOST.EXE

 

I also get this message everytime I restart the computer. "Generic Host Process for Win32 Services has encountered a problem and needs to close. We are sorry for the inconvenience."

 

Performance is less than optimal and sometimes the system freezes up. Hopefully someone can help me clear up my computer woes.

 

 

I tried to run tdsskiller.exe but will only get to 80% and then shutdown program because of error. Tried to run it in safemode with same results.

 

 

GetSystemInfo_SRCREATIONZ_Owner_2011_04_29_10_25_59.zip

sysinfo.zip

Share this post


Link to post
Share on other sites

hello

run this script:

begin
SetAVZPMStatus(True);
SetAVZGuardStatus(True);
SearchRootkit(true, true);
QuarantineFile('C:\WINDOWS\edolibugidixen.dll','');
DeleteFile('C:\WINDOWS\edolibugidixen.dll');
BC_ImportDeletedList;
ExecuteSysClean;
BC_Activate;
RebootWindows(true);
end.

 

instructions: http://forum.kaspersky.com/index.php?s=&am...st&p=678328

-----------------

afterwards post a combofix log:

Download it here: http://download.bleepingcomputer.com/sUBs/ComboFix.exe . Save the file to your desktop.

 

Now, please make sure no other programs are running, close all other windows and pause Kaspersky (Choose the option "resume manually" if still active) until after the scanning and removal process has taken place.

 

Please double click on the file you downloaded. Follow the onscreen prompts to start the scan.

Once the scanning process has started please DO NOT click on the Combofix window or attempt to use your computer as this can cause the scanning process to stall. It may take a while to complete scanning and this is normal.

 

You will be disconnected from the internet and your desktop icons/toolbars will disappear during scanning, do not worry, this is normal and it will be restored after scanning has completed.

 

Combofix will create a logfile and display it after your computer has rebooted. Usually located in c:\combofix.txt , please attach it to your next post. Also, please don't forget to resume the Kaspersky that you paused.

 

Share this post


Link to post
Share on other sites
hello

run this script:

begin
SetAVZPMStatus(True);
SetAVZGuardStatus(True);
SearchRootkit(true, true);
QuarantineFile('C:\WINDOWS\edolibugidixen.dll','');
DeleteFile('C:\WINDOWS\edolibugidixen.dll');
BC_ImportDeletedList;
ExecuteSysClean;
BC_Activate;
RebootWindows(true);
end.

 

instructions: http://forum.kaspersky.com/index.php?s=&am...st&p=678328

-----------------

afterwards post a combofix log:

Download it here: http://download.bleepingcomputer.com/sUBs/ComboFix.exe . Save the file to your desktop.

 

Now, please make sure no other programs are running, close all other windows and pause Kaspersky (Choose the option "resume manually" if still active) until after the scanning and removal process has taken place.

 

Please double click on the file you downloaded. Follow the onscreen prompts to start the scan.

Once the scanning process has started please DO NOT click on the Combofix window or attempt to use your computer as this can cause the scanning process to stall. It may take a while to complete scanning and this is normal.

 

You will be disconnected from the internet and your desktop icons/toolbars will disappear during scanning, do not worry, this is normal and it will be restored after scanning has completed.

 

Combofix will create a logfile and display it after your computer has rebooted. Usually located in c:\combofix.txt , please attach it to your next post. Also, please don't forget to resume the Kaspersky that you paused.

 

 

Here is the Combofix logfile.

ComboFix.txt

Share this post


Link to post
Share on other sites

any change?

could you zip this file: c:\windows\system32\drivers\kbdhid.sys and send it over PM?

Share this post


Link to post
Share on other sites
any change?

could you zip this file: c:\windows\system32\drivers\kbdhid.sys and send it over PM?

 

 

Seems to be the same unfortunately. :aa:

 

Sending the file in PM now.

Share this post


Link to post
Share on other sites
Guest
This topic is now closed to further replies.
Sign in to follow this  
Followers 0